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COMPUTER CONTROLLD VENT AND PRESSURIZATION SYSTEM 
E, J, Cieslewlcz, Aerospace Engineer 
NASA Lewis Research Center 

ABSTRACT 

The paper illustrates how the Centaur space launch vehicle airborne 
computer, which was primarily used to perform guidance, navigation, and 
sequencing tasks, was further used to monitor and control inflight pressuri- 
zation and venting of the cryogenic propellant tanks. Computer software 
flexibility also provided a failure detection and correction capability 
necessary to adopt and operate redundant hardware techniques and enhance 
the overall vehicle reliability. 


INTRODUCTION 

A digital computer formerly used only for guidance, navigation and 
sequencing tasks ij now used on the Centaur stage of the Atlas/Centaur 
and Tltan/'Centaur space launch vehicles to manage pressurization and 
venting of the propellant tanks. Special needs of cryogenically fueled 
vehicles of this type are Illustrated along with the equipment developed 
to manage the pressurization and venting requirements. Full scale ground 
testing of the Centaur stage further pointed out the need for a better 
way to overcome hardware related problems. Techniques used in ground 
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testing were later used as a basis to conceive a software system to 
enhance and simplify the hardware systems for the pressurization tasks. 

Use of the computer also yielded other advantages. Failure sensing and 
correction techniques vere later considered and found to be within tlie 
capabilities of the computer. Computer flexibility features and effects 
on the aspects of redundancy, accuracy, and reliability are also presented. 

The concept of computer control of propellant tank pressures is 
significant, and may parallel the needs of other pressurization control 
systems. Users of the techniques described here may benefit from tlie new 
flexibility brought about through software systems. Adopting techniques 
described may yield benefits of failure detection through software, 
greater accuracy, and repeat ibillty never before thought possible. 


The paper prescnt> definition of the Centaur vehicle, its specialties 
and peculiar needs posed by the cryogenic propellants used for propulsion. 
Background on the conception and development of such a system will be 
described. The equipment used for the computer controlled vent and 
pressurization system (CCVAPS) is described along with the techniques 
finally incorporated to perfonn thi required tasks. The sys^-^>m is 
described conceptually without failure detection and a final section Is 
dedicated to the failure detection and correction features. 
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CIUTAUR SPACE LAUNCH VEHICLE 
Centaur Definition; 

The current Centaur 0-1 space launch vehicle is an improved ver- 
sion of t\e Centaur high energy upper stage which began operational 
use with an Atlas booster in 1966, See figure 1, Further develop- 
ment began in 1969 to integrate the improved Centaur stage with the 
Titan booster. See figure 2, Consequently the Centaur performs 
today with either of these boosters. 

Atlas Centaur vehicles have been used for Interplanetary ventures 
such as, Surveyor, Mariner, and Pioneer and orbital missions such as 
OAO, Intelsat and ATS. Tltan/Centaur, however, having a greater 
payload capability, has been charged with intei^lanetairy missions, 
such as the hellos and Viking spacecraft, which were launched during 
the past year. 

The Centaur on-board computer was previously used primarily 
for guidance, navigation and sequencing tasks. Growing needs 
of preflight calibration of the guidance and navigation 
systems created a need for a larger and faster computer. A 
new generation computer was considered and finally incorpor- 
ated as part of the D-1 Centaur. With the new computer came 
the use of its expanded capabilities to do many other vehicle 
tasks. In addition to the tasks of guidance, navigation and 



sequrncing, the computer was assigned the following n< w duties: Centaur 

and booster stage sequencing, telemetry formatting, digital auto pilot, 
propellant utilization or engine mixture ratio control, monitoring of 
propellant usage for attitude control engines, monitoring helium usage for 
tank pressurization, preflight testing and management and control oi the 
propellant tank venting and pressurization requirements. This latter system 
now used for pressurization and vent control and identified as the Ceampnte r 
Controlled Vent and Pressurization System (CCVAPS) is the> subject of this 
paper. 

Propellant System De scriptlon: 

The propelJants used by the Centaur stage are liquid hydrogen and liquid 
oxygen. The low temperature liquified gases require' special handling not 
only on the ground but also in fligiit. The temperatures of the propellants 
and the environments created by the mission profiles make it nee'essary to 
tailor each flight in terms of pressure versus time. 

The prop»’llant tanks are configured as shejwn in figure !•<. They are 
thin-wall pressure stabilized tanks that are structurally maintnined through 
proper pressurization. Pressures are raised and maintained with a helium 
pressurization system supplemented by boiloff of the cryogenic liquids. 
Venting to reduce pressure is accomplished with vent valves which vent the 
ullage gas overboard when rc'qulred. 

Pressurization and Vent System: 

A schematic of the pressurization and vent system is shown in figure M. 
The elements used to control the functions of venting ard pressurization 
are eilso shown. Components used for pressurization are the high pressure 
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hL’llum storage bottle, solenoid operated pressurization valves, orifices, 
pressure sensing transducers and the vent valves. 

The pressurization and vent system is used to condition th« Centaur 
velticlc propellants prior to engine start and to protect the vehicle against 
structural problems r'jlated to over or under pressurization. 

Pressurization to predetermined levels is physically accomplished by a 
metered Injictlon of helium gas, frjm high pressure (3000 psia) bottles, 
through orlflced pressurization valves into the propellant tanks. The 
actual pressure feedback control process will be discussed in greater 
detail in a subsequent section. 

Venting of the propellant tanks is accomplished by independent control 
of the two position solenoid operated vent valves. When the valves are in 
the relief mode they regulate within a preset control pressure range. When 
the valves are switched to the closed mode venting is inhibited regardless of 
indicated tank pressun . Pressures within the propellant tanks may be 
reduced from values above rt scat pressure to reseat pressure by commanding 
the valve to its relief or open mode. Intermediate pressures of any value 
above reseat may be maintained by alternately switching the vent valve, 
operating mode between open relief and closed as a function of synse. 
propellant tank pressures. 

Ullage Rocket System; 

The ullage rockets are four low thrust hydrogen peroxide engines which 
are mounted on the aft bulkhead. See figure 3. They provide the forces 
necessary to position propellants at the aft end of the propellant tanks 
under low gravity coast conditions. Figure '» shows an output from the 
sequence control unit which operates the ullage rocket system. 
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The cnglm 8 are fired continuously and a bl level thrust, dependinK on 
the propellant management mode, is controlled by firing either 2 or •! engines. 
Switching of alternate pairs of engines is also perfomed midway through the 
tettled coast period to offset the probability of an engine out failure. 
Control is not jeopardized by an engine out problem and stability is 
maintained by the pitch, yaw, and roll attitude control enginis. 

PLCULIAR CI^ITAUR NEEDS 
Propellant Conditlong! 

The liquid oxygen and liquid hydrogen propellants are fed to the engines 
through hydrogen peroxide powered, turbine driven boost pumps. Both pro- 
pellants must be subcooled just prior to starting the^ boost pumps to prevent 
cavitation within the pumps. 

To obtain subcooled propellants, the tanks are vented to pressures corres- 
ponding to vapor preesurc’s of the bulk liquids. Venting is permitted for a 
sufficient period of time to allow for saturation conditions to occur. 

The tank” are then repressurized to predetermined levels. The conditioning 
vent and pressurization levels were based on data obtained from past flights 
and from ground testing of Centaur at the Plum Brook test facility of NASA 
in Sandusky, Ohio. 

Propellant Positioning; 

Propellants are positioned in the bottom of the tanks under low gravity 
conditions by the application of low level thrust f’^om the ullage rockets. 
Propellants in their settled position ready the vehicle for either an engine 
start or for a propellant tank venting sequence. Propellants are clear of 
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vents so as not to vent liquid and the boost pump sumps are filled with 
liquid. 

For long coasts when It Is not feasible to settle propellants continuously, 
a zero gravity coast technique Is used wherever propellants arc allowed to 
drift freely throughout the propellant tanks. When pressures rise to levels 
sufficient to Initiate a vent cycle the ullage rockets are fired to position 
the propellants away from the vents. Thereby only gases and vapors are 
expelled during a vent routine. 

CONTROL EQUIPMENT FOR PROPELLANT SYSTEMS 
Digital Computer System; 

The digital computer unit (DCU) is a stored program random access core 
memory type of machine. Memory capacity Is over 16 thousand words of 24 bits 
each. The flight prograjn may only be loaded Into a select portion of memory 
with special laboratory equipment. This special loading feature was speci- 
fically designed to protect approximately 12 thouiand words of memory 
dedicated to the flight program and telemetry fonnats. Once loaded intc 
protected memory the flight program may not be changed unless special 
laboratory equipment Is used under rigidly controlled conditions. The 
remaining portion of core is accessible and is used for prelaunch testing, 
calibration and storage of temporary constants. 

The software is constructed in modular fashion to reduce lead time in 
flight program design and for quick system response. Each module is an 
entity in itself. As previously mentioned, modules exist fox’ sequencing, 
telemetry formatting, steering, stability, propellant management, hydrogen 
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ptroxldc and helium monitoring, and presHurlzatlon and vi-ntlng control. All 
of the modules are under the control of a program executive. Uper<ition of 
each module and communication between eat.'h of the i.'odules for transfer of 
Infomatlon Is handled through the program exce'Utlve. The task modules 
may be scheduled by the executive at different frequencies during the flight. 
They also may be turm d off or on for different phases of flight. 

Thus, the digital computer has proved to be an Ideal tool fer the task 
of pneumatic system management and control. It has sufficient capability 
to detect, monitor, and maintain all the needs with great flexibility. 
SoftAvare flexibility replaces the Imrtia Involved with tailoring a hardware 
system to match moi’c Increasingly complex missions. Overall flexibility Is 
enhanced and so is reliability. 

Control System Output Equipment; 

Figure 4 shows the DCU and how It is interfaced for Its input and output 
functions. Determinations made- internal to the DCU by any of the moeliiles 
that requires a sequence change are passed on to external systems through 
the sequence control unit. The sequence control unit is essentially a 
bank of relays which receives its commands for switching from the DCU. 

The computer outputs all venting and pressurization commands through 
the sequence control unit. Relays of the SCU operate the propellant 
settling ullage rockets, the solenoid operated vent valves and the 
appropriate pressurization solenoid valves to maintain complete control 
of the pressures within the propellant tanks. The computer controlled 
vent and pressurization system module of the flight program is scheduled 
to perfc :n cither of the vent or pressurization tasks by the sequencer 
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module of the computer. Digital to analog convirtcra which are part of 
the computer, provide the final feedback of information on tank presaurra 
and ayatem performance back to the CCVAPS module within the computer. 

These elimenta shown in figure 9 comprise the total closed loop control 
system for propellant tank venting and pressurization. 

COMPUTER CONTROL OF PRESSURIZATION AND VOTING 
Computer Controlled Vent and Pressurization System! 

The computer controlled vent and pressurization system (CCVAPS) used 
for the Centaur launch vehicle is schc met ically shown in figure 9. The 
syste?m is comprised of the digital computer, the sequence control unit, the 
vent systeme, the pressurization system, and the pressure sensing system. 

The CCVAPS controls and maintains tank pressures by operating vent valves 
and pressurization valves in response to sensed tank pressures. The 
digital computer monitors pressures prior to the sequence control unit 
relays. 

Figure 9 shows how pressures within the propellant tanks are fed back to 
the digital computer for control purposes. Information gathered by the 
pressure transducers is relayed to the computer through analog to digital 
converters which are a part of the computer. The computer uses this 
information to exercise control over the venting and pressurization require- 
ments of the control program. 

Pressure measurements are made with redundant transducers as shown in 
figure 5, These transducers work in conjunction with the computer software 
program to determine the adequacy of the pressurii. it ion system performance. 
They also provide a check on the performance of the measuring devices 
themselves. Methods of failure detection and correction are discussed 


in a later section. 
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The basic control modes are pressurization and venting. A flow diagTam 
in figure 6 shows the two .nodes of pressurization and venting control. 

When the CCVAPS program is called on by the sequencer to perform it do« s 
so at one of three processing rates. For pressurization, the program is 
processed 2S times per second. Venting is proces8«*d at S times r>er second 
during propellant settling preceding an actual vent and at O.S times per 
second during the vent. 

Hach step of the computer program flow diagram will be discussed to 
illustrate how the computer manages and maintains the propellant tank 
pressures within the desired limits. 

Pressurization System Control Bv Computer; 

Entry into the pressurization portion of the flow diagram is made prior 
to each engine start and at times before spacecraft separation. Logic 
references exist to select pressurization levels consistent with engine 
start and tank stnictural require?ment8 dependent upon the particular mission. 
Shortly after the vent valves are closed by the sequencer portion of the 
flight program, , the CCVAPS program is sequenced into op« ration. Initial tank 
pressures are sensed by the propellant tank transducers and passed on to the 
computer through the analog to digital converters for preasu»’e calc*ulatlons. 

An example of the pressurization before engine start is shown in 
figure 7. The computer adds the delta pressure increase requirement shown 
for engine start to the Initial pressures observed. This pressure is 
compared to a maximum allowed valve closing pressure and the lower of the 
two pressures is used for control. Pressures calculated are used for 
raising and maintaining propellant tank pressures at the proper levels by 
Issuing discretes as shown in the flow diagram (Figure 6). 





The presdurizat lon Increade riquinmtnta art a i'unctlun of several 
variables: the net positive suction pressure needed for the boost pumps, 
size of propellant tank ullages, rate of sensing tank pressures, pressure 
rise rates after commanding pressurization valves closed and thermal 
effects causing pressure overshoots after valve closure. In addition 
pressure overshoot and undershoot about the programmed deadband must also 
br defined. Typical values selected arc as shown in figure 7. 

Ttic flexibility of the computer control system simplifies changes to be 
made to tailor each vehicle flight to its special riquirements. 

Venting System Control Bv Computer: 

Entry into the vent portion of the flow diagram, figure 6 is made bi tween 
each engine firing of multiple burn missions and precedes the pressurizat ion 
sequenc'e before the second and subsequent engine starts. Pressure readings 
are taken over predetermined intervals of time and averaged as shewn in 
figure 8. Thi average pressure is then compared to a vent initiation 
pressure chosen for venting the propellant tank in question. After the 
average pressure has exceeded the initiation pressure a vent sequence is 
starred. 

Reaction to vent initiation is dependent upon conditions at the time of 
detection. If in a state of zero gravity coast, ullage rockets are commanded 
to start to settle propellants. Should this be the situation, and should 
tank pressure still rise, venting will occur at pressures just above the 
initiation limit until the propellant settling period is over. At completion 
of the prescribed propellant settling period, venting is initiated. During 
the venting interval pressures are regulated within a 1.0 psi band with the 
minimum pressures just above the vent valve reseat pressure. After the vent 
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pirlod is completed pressure avercginK Is again resumed until further 
venting is needed or until the vent enable period chosen is completed. 

The sequencing and techniques described are the particular ones chosen 
for the needs of most missions. Variations to the techniques described 
are only limited by the imagination. Many variations could havi been used. 

Pressurization and Venting T»chniguc Development; 

Variations in pressurization and venting techniquis were developed 
using full scale testing methods. Tests were conducted on a full scale 
thick walled Centaur type tank and finally on ttie Centaur tank itself. 

Full duration rocket engine firing tests with the Centaur vehicl« at 
altitude conditions were run at NASA's Plum Brook Test Fncillty of 
Sandusky, Ohio. Pressurtza« .o of th< propellant tanks for thest tests 
was accomplished using ( wiivcnt ional hardware. Pressure switches were 
used to control solenoid operated pre-#surlzation valvfs. This method of 
pressurization worked well, but the system lacked flexibility as the 
pr< ssurizatlui'. requirements were changi d in the course of the test program. 
Procurement of nn^^ pressure switches would have caused a schedule si .j 
so an alternate method of pressurization control was developed. 

The pressure switch was essentially ri ,')laced by on electronic comparator. 
The pressure transducer output voltage was compared to a voltage repre-sentlng 
the desired pressure switch setting (set point). The comparison output was 
then used to drive relays which operated the solenoid valves. Pressurization 
was then regulated by the opening or closing of the valves. 

Use of these set point and feedback principals eventually set the way 
for use of the digital computer. The fast sensing and reaction capabilities 
of the computer established the feasibility for development of the CCVAPS 


system. 
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FAILURi: DCTECTION AND CORRECTION TECHNIQUES 

Techniques used for failure detection and correction were made possible 
as a result of the spped of the c jinputt r. Data sampling at a rate of SO 
times a second provides a rapid detection of terrors between a given control 
and reference pressure at any instant. Therefore upon sensing an error it 
v;as possible to switch to a spare transducer for control in a short Interval 
of time. This type of failure detection and correction provides valuable 
redundancy In system control. Similarly, valve failure detection can be 
achieved by observation of the pressurization effects after commanding a 
valve open oi* closed, anc If a vehicle failure Is detected a switchover can 
be made to a redundant valve. 

Pressurization Valve Failure; 

A pressurization valve failure is essential 'V detected by computer 
observation of pressure rise and pressure decay rates after a pressurization 
valve is commanded open or closed. Once the computer has determined tht 
desired pressurization valve closing pressures it issues commands through 
the sequence contiol unit to open the pressurization valves. See figure S. 
Pressure in the tanks increases and as It does the computer monitors these 
pressures so that the pressurization valves may be commanded closed when 
the previously calculated pressure is reached. 

During the pressurization, the rate at which tht pressure is rising is 
obsc.-^ed. See figure 9. Should the pressure rise not occur or be too slow 
It lu assumed that a pressurization valve has failed to open fully or not 
at all. A detection of failure to open for two consecutive cycles, requires 
that the prime pressurization valven, see figure 5, be closed and that the 
backup valves for each tank be used for all further pressurization. 



If the valve does open properly and the proper pressure rise rate Is 
detected, pressure will continue to rise until the desired valve closini; 
pri ssure Is reached. When this pressurt is reached a command is sent to 
the SCU to close the valve. Thi’ duration between the time of detection 
and the closing of the valve allows more pressurant Into the tank and 
results in some expected overshoot. An allowance for the overshoot in 
pressure has been made in the original calculation of valve closing pressure. 
Closing pressure is derated by the amount of expected overshoot. II' 
pressure increases to a value above the allowance for overshoot and the 
overpressure is confirmed by two consecutive compute cycles, then switch 
over is hiadc to the backup pressurization valve system. 

The bands of acceptable overshoot anti unt'^rshoot allowed before the backup 
pressurization system is called upon to perform is sliown in figui’e 9. As 
stated earlier, both propellant tanks are involved in the switch to the 
redundant system after a failure in the pressm-lzatlon system is detected. 
Figure 5 shows the configuration of the pressurization valves for both systems 

The failure test of pressure rise with time after initiation of pressuri- 
zation is in effect only until the tank in question reaches valve closing 
pressure for the first time. See figure 9. If by chance a propellant tank 
transducer failure should be detected during the initial pressurization 
before arriving at the first valve closing a second test is made. The 
second test is a pressure rise rate test and is reinitiated at the exact 
time the spare transducer is introduced for control. The same criteria 
used at pressurization start is used for the second test. If the pressure 
reaches closing pressure before the second test is completcdj it is cancelled. 
Overshoot and undershoot tests remain in effect. 
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After tank pressures have risen to valve closing pressure values and 
after the expected overshoot, tank pressure will decay primarily due to 
thermal effects upon the pressurant gas,. When tanV; pressure drops below 
the valve closing pressure and beyond by the predetennim d deadband of 
operation, the pressurization valves open again. Deadband limits for valve 
opining and closing arc stored as data just as other predetermined limits 
and parameters. 

each tank then Independently continues this cyclic mode of control until 
instructed otherwise. Any change in pri ssurization level parameters, failure 
detection limits or timing is handled through the sequencing module of the 
computer. A new codeword Is issued by the sequencer module and is then 
interpreted by the CCVAPS module. By codeword the CCVAPS modulo detects 
infonnation leading to direction on which valves are to oe u^cd, for 
pressurization and venting, and which set of constants are to be used for 
that particular portion of the flight. 

Pressure- Transducer Failui’c; 

Propellant tank pressures are measured by transducers using the "pair 
plus a spare" concept of redundani-y. Figure S shows the three transducers 
in each propellant tank which are used to provide the computer with system 
pressures data. 

One transducer is used for control, the second for reference, and the 
third for substitute control should a discrepancy be detected between the 
first and second transducer. 

Transducer failure detection is performed whenever the CCVAPS module is 
turned on for venting or pressurizing the propellant tanks. Two types of 
failure detection tests are made to detemine ii' the primary or reference 
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transducer has failed. One test measures the absolute difference in 
pressures measured between Lhe primary and reference transducer at all tlm«'s. 
An exception is during the first step of pressurization from the time the 
pressurization valves are commanded open until the propellant tank reaches 
valve closing pressure. A second test is made during the first pressuri- 
zation step by comparing the two instantaneous values of pressure increase 
from the Initial pressure at the start of pressurization. 

Judgment for failure detection is baaed upon the magnitude of the* 
transducer dlffrreneie readings for both tests described. The failure 
detection also requires there must be two consecutive out of tolerane-e 
conditions. After a failure has been detected, control is switched to the 
spare transducer. In addition the program modifies the closing pressure 
value it previously calculated for the propellant tank in question. Th« 
valve closing pressure would be incremented by the allowable failure detection 
pressure differential. 

Figure 10 illustrates a specific situation where the control transducer 
No. 1 was just within detection limits and then drifts out of tolerance 
during a pressurization cycle. Switching control from transducer No. 1 to 
transducer No. 3 requires an incrementation to compensate for loss in pressure 
by an amount equal to the detection limit. 

CONCLUDING ROIARKS 

This paper describes the space launch vehicles using the new computer 
controlled vent and pressurization system. It has shown that the special 
needs of the cryogenically propelled Titan/Centaur and Atlas/Centaur 
vehicles are complex and have been relieved by the incorporation of the 
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on-board computer for control of the venting and pressurization tasks. An 
explanation of the control equipment and the methods «'mployed to use tliem 
are included. Also explained are the techniques used for programmed ••ontrol 
and failure detection of pressurization system and pressure sensing hardware’. 
The application of this versatile control concept would also Icfid itself to 
a wide range of applications in industrial or other non-aerospace systems. 






Fig. Z-Propellant Tank Configuration 
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Fig. 4-Sahematio of Computer Controlled Vent 4 Pressurization System (CCVAPS) 
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Fig. 5 - Sihemtia of Redundant Co^uter Controlled Vent i Pressuriaation (CCVAPS) 







Fig. 6-Computer program Flow Diagram 
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Fig. 7-Pret' auritaioK Illustration 




Fig. S^Venting Illu^tratior 





'i-Vali}e Failwre Illustration 



Fig. lO-Transduaer Failure Illustration 



